# Get "\_dateparsefailure" when use Elasticsearch input plugin

**URL:** https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357
**Category:** Logstash
**Created:** [January 8, 2019, 11:39am UTC](https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357 "2019-01-08T11:39:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![occultskyrong](https://avatars.discourse-cdn.com/v4/letter/o/8e8cbc/32.png) [@occultskyrong](https://discuss.elastic.co/u/occultskyrong)
#### Post date: [January 8, 2019, 11:39am UTC](https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357/1 "2019-01-08T11:39:57Z")

</div>

I just use [`Elasticsearch input plugin`](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html)

like this :

```auto
input {
  elasticsearch {
    hosts => "localhost:9200"
    index => "test"
    query => ""
    size => 1
    scroll => "300s"
    docinfo => true
  }
}

```

and then , i use `date filter`

```auto
  date {
    match => ["@timestamp","ISO8601","yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"]
    timezone => "Asia/Shanghai"
    target => "timestamp"
    # add_field => { 
    # "[timestamp][year]" => "%{+yyyy}" 
    # "[timestamp][month]" => "%{+MM}"
    # "[timestamp][day]" => "%{+dd}"
    # "[timestamp][dayOfYear]" => "%{+DD}"
    # "[timestamp][dayOfWeek]" => "%{+e}"
    # "[timestamp][hour]" => "%{+HH}"
    # "[timestamp][minute]" => "%{+mm}"
    # "[timestamp][keyword]" => "%{+yyyy-MM-dd HH:mm:ss}"
    # }
  }

```

It's always get an error "\_dateparsefailure".  
But this field is in this format.

 ![WX20190108-193757%402x](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0db0d3da9cb484ccea8024c2dedf66dd5d13f09e.png)

In the `test` index , the `@timestamp` field type in the mapping is

```auto
"@timestamp": {
  "type": "date"
},

```

So , who knows what's the error mean ?

thank you ~

---

<div class="post-metadata">

### Author: ![occultskyrong](https://avatars.discourse-cdn.com/v4/letter/o/8e8cbc/32.png) [@occultskyrong](https://discuss.elastic.co/u/occultskyrong)
#### Post date: [January 9, 2019, 3:01am UTC](https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357/2 "2019-01-09T03:01:28Z")

</div>

just solved by [Date Custom Field Timezone](https://discuss.elastic.co/t/date-custom-field-timezone/108673/6)

the api for `ruby strftime` see [https://apidock.com/ruby/DateTime/strftime](https://apidock.com/ruby/DateTime/strftime)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 6, 2019, 3:14am UTC](https://discuss.elastic.co/t/get-dateparsefailure-when-use-elasticsearch-input-plugin/163357/3 "2019-02-06T03:14:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.